{"metadata": {"vulnerability": "CVE-2026-75083", "count": 10, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-08-17T16:17:45.295Z", "date_only": false, "value": "2026-08-17T16:17:45.295Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-75083", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T16:45:56.541Z", "date_only": false, "value": "2026-10-14T16:45:56.541Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-75083", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T16:45:56.541Z", "date_only": false, "value": "2026-10-14T16:45:56.541Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / zephyr", "record": "CVE-2026-75083", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T17:19:10.307Z", "date_only": false, "value": "2026-10-14T17:19:10.307", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-75083", "record": "FKIE_CVE-2026-75083", "field": "published"}, {"timestamp": "2026-10-14T22:15:39.137Z", "date_only": false, "value": "2026-10-14T22:15:39.137762Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441569665320719", "record": "CVE-2026-75083", "field": "creation_timestamp", "uuid": "806fcd05-23cf-4c3d-bd28-8ccc43b48c90", "content": "CVE-2026-75083 Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length reported by the radio. The interrupt handler kw41z_isr() obtained that length from the RX_FRAME_LENGTH field of the ZLL IRQSTS register \u2014 a copy of the PHY header length byte of the frame received over the air \u2014 and only rejected the value zero. A reported length of one therefore underflowed to pkt_len == 255.\nBecause the packet is allocated with NET_AF_UNSPEC on a non-Ethernet L2, net_pkt_rx_alloc_with_buffer() does not clamp the request to the interface MTU; with the default fixed-size buffer pool (CONFIG_NET_BUF_FIXED_DATA_SIZE, CONFIG_NET_BUF_DATA_SIZE=128) the allocation succeeded as a chain of two fragments. The subsequent register-to-buffer copy loops write into the first fragment only, so 255 bytes were written into a 128-byte net_buf data block, overrunning it by up to 127 bytes into adjacent network-buffer-pool memory, and reading up to 128 bytes past the end of the radio's PKT_BUFFER_RX register array.\nThe length field originates from an unauthenticated frame transmitted by any device within 802.15.4 radio range, and is captured by the hardware at PHY-header time \u2014 before frame filtering has completed \u2014 while the handler samples it after clearing the interrupt status, so an attacker flooding frames with a length byte of one can drive the underflow. The impact is memory corruption in the shared receive buffer pool from interrupt context, most plausibly a crash or corruption of other packets' data; the overflowing bytes are radio register contents rather than attacker-authored data, which bounds the integrity impact.\nThe fix rejects any length below KW41Z_FCS_LENGTH and additionally verifies net_buf_tailroom() of the first fragment before the copy loops, which also covers the CONFIG_NET_L2_OPENTHREAD variant of the size computation.\nhttps://www.cve.org/CVERecord?id=CVE-2026-75083https://github.com/zephyrproject-rtos/zephyr/commit/51d71864578c08eb1a1201f87b46ec81c8609d62https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2pwx-gg6f-535f#zephyrproject #zephyr#CVE_2026_75083#bot", "url": "https://infosec.exchange/users/cve/statuses/117441569665320719"}, {"timestamp": "2026-10-16T15:25:03.202Z", "date_only": false, "value": "2026-10-16T15:25:03.202886Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-75083", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T15:25:03.202Z", "date_only": false, "value": "2026-10-16T15:25:03.202886Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-75083", "record": "FKIE_CVE-2026-75083", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T15:31:46.531Z", "date_only": false, "value": "2026-10-16T15:31:46.531Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-75083", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:31:46.531Z", "date_only": false, "value": "2026-10-16T15:31:46.531Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-75083", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T16:21:02.140Z", "date_only": false, "value": "2026-10-16T16:21:02.140", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-75083", "record": "FKIE_CVE-2026-75083", "field": "lastModified"}]}